IN THE CLAIMS 

Please amend the claims to read as follows : 
Listing of Claims 



1. (Currently Amended) A network monitoring system for 
monitoring a communication state on a network in which action 
explanation information for explaining a single action is divided 
into a plurality of packets, the network monitoring system 
comprising: 

a data acquisition section that acquires a the plurality of 
packets flown on the network; 

a data analysis section that acquires the action explanation 
information from the plurality of packets acquired by the data 
acquisition section; 

a display-information generation section that generates 
information of each individual action occurring on the network on 
the basis of the action explanation information acquired by the 
data analysis section; and 

a display unit that displays the information generated by 
the display- information generation section, wherein: 

in response to a request by a user, the display-information 
generation section regenerates, for continuous play back, 
information of a sequence of individual actions that occurred on 
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the network and cooperates with the display unit to display, 
during each play back, the regenerated information of each 
individual action of the sequence at the same time interval 
within the sequence as the action occurred. 

2. (Original) The network monitoring system according to 
claim 1, wherein the action explanation information is defined in 
advance . 

3. (Original) The network monitoring system according to 
claim 1 , wherein the data analysis section identifies kinds of 
the packets acquired by the data acquisition section and acquires 
the action explanation information from the packets on the basis 
of the identified kinds of the packets . 

4. (Original) The network monitoring system according to 
claim 1 , wherein the action explanation information includes 
sending source computer information, destination computer 
information, and action information. 

5. (Previously Presented) The network monitoring system 
according to claim 1, further comprising: 
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an analysis data storage section that stores the action 
explanation information acquired by the data analysis section, 
wherein : 

the display-information generation section regenerates the 
information of the sequence of individual actions that occurred 
on the network from the action explanation information stored by 
the analysis data storage section. 

6. (Previously Presented) The network monitoring system 
according to claim 5 , wherein : 

the action explanation information stored by the analysis 
data storage section includes time information, which corresponds 
to the time at which the single action occurred; and 

the display-information generation section determines the 
time interval, within the sequence, that each individual action 
occurred using the time information stored by the analysis data 
storage section . 

7. (Previously Presented) The network monitoring system 
according to claim 5 , wherein the display-information generation 
section continuously regenerates the sequence after each 
predetermined period, which period is accurate within 500 
milliseconds . 
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8. {Previously Presented) The network monitoring system 
according to claim 1 , wherein the display-information generation 
section extracts and generates the information of each action 
occurring on the network in accordance with a display setting set 
by a user. 

9. {Currently Amended) A network monitoring method for 
monitoring a communication state on a network in which action 
explanation information for explaining a single action is divided 
into a plurality of packets, the method comprising: 

acquiring a the plurality of packets flown on the network; 

acquiring the action explanation information from the 
plurality of acquired packets; 

generating information of each individual action occurring 
on the network on the basis of the acquired action explanation 
information; 

regenerating for continuous play back, in response to a 
request by a user, information of a sequence of individual 
actions that occurred on the network; and 

displaying on a display unit, during each play back, the 
regenerated information of each individual action of the sequence 
at the same time interval within the sequence as the action 
occurred. 

5 



10. 

claim 9, 
advance . 



(Original) The network monitoring method according to 
wherein the action explanation information is defined in 



11. (Original) The network monitoring method according to 
claim 9, wherein in the acquisition of the action explanation 
information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation information 
is acquired from the packets on the basis of the identified kinds 
of the packets . 

12. (Original) The network monitoring method according to 
claim 9, wherein the action explanation information includes 
sending source computer information, destination computer 
information, and action information. 

13. (Previously Presented) The network monitoring method 
according to claim 9, further comprising: 

storing the acquired action explanation information, 
wherein: 

the information of the sequence of individual actions that 
occurred on the network is regenerated from the stored action 
explanation information . 
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14. {Previously Presented) The network monitoring method 
according to claim 13, wherein: 

the stored action explanation information includes time 
information, which corresponds to the time at which the single 
action occurred; and 

the time interval , within the sequence , that each individual 
action occurred is determined using the stored time information. 

15. (Previously Presented) The network monitoring method 
according to claim 13, further comprising continuously 
regenerating the sequence after each predetermined period, which 
period is accurate within 500 milliseconds. 

16. (Previously Presented) The network monitoring method 
according to claim 9 , wherein the information of each action 
occurring on the network is extracted and generated in accordance 
with a display setting set by a user, 

17. (Currently Amended) A network monitoring program 
recorded on a computer readable medium and executable by a 
computer for the purpose of monitoring a communication state on a 
network in which action explanation information for explaining a 



7 



single action is divided into a plurality of packets, the program 
making the computer perform a process comprising: 

acquiring a the plurality of packets flown on the network; 

acquiring the action explanation information from the 
plurality of acquired packets; 

generating information of each individual action occurring 
on the network on the basis of the acquired action explanation 
information; 

regenerating for continuous play back, in response to a 
request by a user, information of a sequence of individual 
actions that occurred on the network; and 

displaying on a display unit, during each play back, the 
regenerated information of each individual action of the sequence 
at the same time interval within the sequence as the action 
occurred. 

18. (Original) The network monitoring program according to 
claim 17, wherein the action explanation information is defined 
in advance. 

19. (Original) The network monitoring program according to 
claim 17, wherein in the acquisition of the action explanation 
information, kinds of the packets acquired by the packet 
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acquisition are identified and the action explanation information 
is acquired from the packets on the basis of the identified kinds 
of the packets . 

20. (Original) The network monitoring program according to 
claim 17, wherein the action explanation information includes 
sending source computer information , destination computer 
information, and action information. 

21. (Previously Presented) The network monitoring program 
according to claim 17, wherein: 

the process further comprises storing the acquired action 
explanation information; and 

the information of the sequence of individual actions that 
occurred on the network is regenerated from the stored action 
explanation information . 

22. (Previously Presented) The network monitoring program 
according to claim 21, wherein: 

the stored action explanation information includes time 
information, which corresponds to the time at which the single 
action occurred; and 
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the time interval, within the sequence, that each individual 
action occurred is determined using the stored time information. 

23. (Previously Presented) The network monitoring program 
according to claim 21, wherein the process further comprises 
continuously regenerating the sequence after each predetermined 
period, which period is accurate within 500 milliseconds. 

24. (Previously Presented) The network monitoring program 
according to claim 17, wherein the information of each action 
occurring on the network is extracted and generated in accordance 
with a display setting set by a user. 
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